---
id: CVE-2026-63875
title: 'arm64: tlb: Flush walk cache when unsharing PMD tables'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  arm64: tlb: Flush walk cache when unsharing PMD tables

  When huge_pmd_unshare() is called to unshare a PMD table, the
  tlb_unshare_pmd_ptdesc() function sets tlb->unshar…
severity: high
cvss: 7.8
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'
cvssSource: cna
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 6495204f8219a57859669d618b25d06176d5a872 <
    dced308d7d6a0de1c09d2058f38f1aaaf5cbb914
  - >-
    Linux >= ce4cf24761467756462c0e1dbe4a5e9c9eb520fc <
    47490bbb05c8c0e09cc3cfd237d8934ffc340583
  - >-
    Linux >= daa6707b71a2da23a82979fa21f788aeb706f1a2 <
    0199c9d57861f17b556b6cba1f765c7cce79745b
  - >-
    Linux >= ff37dd18ce7739a26aab0cc2d31006a45e6bde63 <
    d766a49d9b55705c4737cd8bb5d3faa2d31330fd
  - >-
    Linux >= da06bb0ca45b1ca6f1ab55023e34e61a520337f3 <
    8ca7284da0e67b3e71d90ec17f08286774245ad9
  - >-
    Linux >= 9b671f6f432be07c0ddd66e437d6d0e0db684f83 <
    fe93e907b1af03cc229a80aa64a570a103d2b279
  - >-
    Linux >= 8ce720d5bd91e9dc16db3604aa4b1bf76770a9a1 <
    48125cd9c55cbe297b59fd1f9bda48b0960bd181
  - >-
    Linux >= 8ce720d5bd91e9dc16db3604aa4b1bf76770a9a1 <
    c2ff4764e03e7a8d758352f4aceb8fe1be6ac971
  - Linux >= 5.10.253 < 5.10.259
  - Linux >= 5.15.203 < 5.15.210
  - Linux >= 6.1.167 < 6.1.176
  - Linux >= 6.6.127 < 6.6.143
  - Linux >= 6.12.74 < 6.12.93
  - Linux >= 6.18.13 < 6.18.35
  - Linux 6.19
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-10-16T15:32:42.432974Z'
published: '2026-07-19'
updated: '2026-10-16'
sourceUpdated: '2026-10-16T15:42:09.318Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-63875'
references:
  - url: 'https://git.kernel.org/stable/c/dced308d7d6a0de1c09d2058f38f1aaaf5cbb914'
  - url: 'https://git.kernel.org/stable/c/47490bbb05c8c0e09cc3cfd237d8934ffc340583'
  - url: 'https://git.kernel.org/stable/c/0199c9d57861f17b556b6cba1f765c7cce79745b'
  - url: 'https://git.kernel.org/stable/c/d766a49d9b55705c4737cd8bb5d3faa2d31330fd'
  - url: 'https://git.kernel.org/stable/c/8ca7284da0e67b3e71d90ec17f08286774245ad9'
  - url: 'https://git.kernel.org/stable/c/fe93e907b1af03cc229a80aa64a570a103d2b279'
  - url: 'https://git.kernel.org/stable/c/48125cd9c55cbe297b59fd1f9bda48b0960bd181'
  - url: 'https://git.kernel.org/stable/c/c2ff4764e03e7a8d758352f4aceb8fe1be6ac971'
tags:
  - cve.org
epss: 0.00176
epssPercentile: 0.0666
ingestedAt: '2026-10-16T17:24:46.771Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

arm64: tlb: Flush walk cache when unsharing PMD tables

When huge_pmd_unshare() is called to unshare a PMD table, the
tlb_unshare_pmd_ptdesc() function sets tlb->unshared_tables=true
but the aarch64 tlb_flush() only checked tlb->freed_tables to
determine whether to use TLBF_NONE (vae1is, invalidates walk
cache) or TLBF_NOWALKCACHE (vale1is, leaf-only).

This caused the stale PMD page table entry to remain in the walk cache
after unshare, potentially leading to incorrect page table walks.

Fix by including unshared_tables in the check, so that when
unsharing tables, TLBF_NONE is used and the walk cache is properly
invalidated.

Here is the detailed distinction between vae1is and vale1is:

| Instruction Combination  | Actual Invalidation Scope                         |
| ------------------------ | --------------------------------------------------|
| `VAE1IS`  + TTL=`0`      | All entries at all levels (full invalidation)     |
| `VAE1IS`  + TTL=`2` (L2) | Non-leaf at Level 0/1 + leaf at Level 2           |
| `VALE1IS` + TTL=`0`      | Leaf entries at all levels (non-leaf not cleared) |
| `VALE1IS` + TTL=`2` (L2) | Leaf entry at Level 2 only                        |

## Affected

- `Linux >= 6495204f8219a57859669d618b25d06176d5a872 < dced308d7d6a0de1c09d2058f38f1aaaf5cbb914`
- `Linux >= ce4cf24761467756462c0e1dbe4a5e9c9eb520fc < 47490bbb05c8c0e09cc3cfd237d8934ffc340583`
- `Linux >= daa6707b71a2da23a82979fa21f788aeb706f1a2 < 0199c9d57861f17b556b6cba1f765c7cce79745b`
- `Linux >= ff37dd18ce7739a26aab0cc2d31006a45e6bde63 < d766a49d9b55705c4737cd8bb5d3faa2d31330fd`
- `Linux >= da06bb0ca45b1ca6f1ab55023e34e61a520337f3 < 8ca7284da0e67b3e71d90ec17f08286774245ad9`
- `Linux >= 9b671f6f432be07c0ddd66e437d6d0e0db684f83 < fe93e907b1af03cc229a80aa64a570a103d2b279`
- `Linux >= 8ce720d5bd91e9dc16db3604aa4b1bf76770a9a1 < 48125cd9c55cbe297b59fd1f9bda48b0960bd181`
- `Linux >= 8ce720d5bd91e9dc16db3604aa4b1bf76770a9a1 < c2ff4764e03e7a8d758352f4aceb8fe1be6ac971`
- `Linux >= 5.10.253 < 5.10.259`
- `Linux >= 5.15.203 < 5.15.210`
- `Linux >= 6.1.167 < 6.1.176`
- `Linux >= 6.6.127 < 6.6.143`
- `Linux >= 6.12.74 < 6.12.93`
- `Linux >= 6.18.13 < 6.18.35`
- `Linux 6.19`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.